Nothing mutates until a human says so.

1. 1Substantial work starts as a plan. A human accepts it once. Acceptance grants no mutating authority on its own.
2. 2Work proceeds as tickets, and every ticket starts proposed — including the ones humans create.
3. 3A human approves a ticket with an owner, acceptance criteria, and a complete impact map.
4. 4If the owner is an agent, the approval queues durable work for that agent.

The first layer is a hard ceiling: identity, the sandbox, classified tools, and either a workable ticket owned by the agent or an explicit grant in chat. The second layer is the conversation’s permission mode, which decides how much of that ceiling runs without asking each time.

A mode can narrow what runs without asking. It can never widen the ceiling.

Every ticket carries scope paths. A path ending in / grants a subtree; anything else is exactly one file. Approving a ticket grants that footprint, not workspace-wide write access.

Shell commands are a separate capability a human grants explicitly, because a shell command’s writes cannot be known in advance.

• A tool nobody has classified can never be authorized. A new tool refuses until someone deliberately classifies it.
• If a permission decision cannot be recorded, the action does not run. An unauditable mutation is worse than a refusal.
• A chat grant still fails on an unclassified tool or a path outside the sandbox.

A proposed item is a card in the chat timeline. A paused run’s permission prompt sits on that run, or appears as its own card. The queue and the board tab are other views of the same records — approving in one place settles it everywhere.

Every board mutation appends one audit row and one canonical thread event in the same transaction. Every event carries who did it. Completing a ticket requires evidence.